What is SSL certificate?
Table of content
Secure Socket Layer (SSL / TLS) is a protocol used to protect the connection between your website and its users. The SSL certificate encrypts the data and protects the channel that enables the communication. In other words all the data transmitted between the user’s web browser and your website are kept safe. Thus, you prevent the stealing of sensitive information like phone numbers, e-mail addresses, credit card details, etc.
Metaphorically said, the SSL serves as a padlock that you place on your website. It secretes the information and makes it visible only for you and the user of your service because you are the only ones having the key for the encrypted connection.
Why you have to use an SSL certificate?
SSL is the easiest way to legitimate your activity online. The certificate protects from the theft of user data that are transmitted through your website and helps you increase the trust your clients have in the service you offer. A HubSpot’s survey from 2017 shows that only 17% of all potential clients would buy from a website indicaded as “Not secure” by web browsers.
On the other side, since July 2018 the most popular web browser (Chrome) has been indicating websites without SSL as unreliable. The message “Not secure” appears in front of the domain name of each an every website that is not protected. It reminds users that the connection is not safe and they should not enter personal data and payment details on this website. Google took this step to emphasize again on the need for the Web to be safer and more-optimized. Therefore, every business that sells online must have an SSL to increase the confidence of its customers in the business.
If you already have a website and you don’t have an active SSL, you must learn more about the technology and the tendencies regarding cyber security.
How safe is the SSL protocol?
Your website security depends on numerous factors and the availability of an SSL guarantees that the connection is protected from theft. The issuers of SSL certificates usually back up their promises with huge amounts of money in case of a data breach and stealing.
The connection protection is ensured by the encryption of the channel where the information is transmitted. The encryption is a complex mathematical process in which all the information is being encrypted and decrypted by the server and the client. The level of protection of an SSL certificate is determined by the length of the key characterizing each certificate (in bits) and determines the security level. The most popular SSL certificates have a length of 128 bits and 256 bits.
How does an SSL work?
Regular users do not notice the job done by an SSL certificate. It takes care for the information security and keeps it protected from stealing and misuse before it gets to the recipient.
What is the process of connection encryption?
When the client tries to open a web site their browser makes a request to the server and then gives back a response. Already provided with an answer the browser checks the information for the certificate and then makes sure the website has a legitimate SSL certificate. Using the information from the certificate a key is generated for encryption that is being sent to the server. Then it decrypts it and together with the browser make final steps to generate the final key for cryptation used to codify the communicaton between them.
How do we know if a website has an SSL?
You can easily differentiate the websites that have an SSL and the ones that do not. In front of the domain name of every secure site there is a green padlock. Another difference you will find in the prefix “https://” before the address bar meaning “Secure HTTP” that guarantees the opened site is authentic and the connection is secure. Websites without an SSL are being marked with “http://”.
Site seal is a selective option visualizing the presence of an SSL on a given website. Every owner of a business page could add it if they want. There are two types of Site seal – Dynamic and Static. The difference between them is the activity of the seal – whether a person could click on it. When it is being opened the user receives more information about the organization and the SSL used. The dynamic seal is a better sign for the security of a website which therefore increases customer trust in the business.
How does an SSL influence the SEO of a website?
SEO (Search Engine Optimization) comprises all the factors that influence the ranking of a given website in search engines. Whether a website is well-optimized is being determined by the loading speed, the relevance of the content and the security of the website. Here is the role of the SSL certificate that could improve the SEO ranking of your website. Bear in mind that in the process of transition to HTTP/2 you muse have an SSL installed on your website. HTTP/2 increases the speed of your site which automatically improves your SEO ranking.
Types of SSL certificates
Regardless of the function of a given website it must have an SSL certificate. There are different types of SSLs for every website depending on your need: whether you want to certify your domain or legitimate your business.
Unlike other certificates issued by reputable providers, this type of certificate is related to internal objectives for businesses. It is free and does not influence the budjet of the company. However, using such type of certificates is risky because browsers do not recognize them. Moreover, we do not recomment using them for public websites.
Domain Validation SSL Certificate (DV)
These certificates are used for validation of the website’s domain name and do not provide big money guarantee in case of data breach. They do not authenticate the organization and that’s the reason they are so affordable for individual users. The issue of such a certificate takes no more than 24 hours and does not require additional verifications. This makes it suitable for websites and blogs with low traffic that do not process sensitive personal data of users. Examples for this type of certificates are Let’s Encrypt and Comodo AutoSSL by HostPulse which are free. There are also paid certificates that not only validate the domain name but are also mobile-friendly and provide money guarantee.
Organisation Validation SSL (OV)
This type of SSL certificates are more expensive than the DV certificates. They not only validate the domain name but also legitimate the identity of the company. Before their issue the orgnaization is being examined by a certified issuer to guarantee its authenticity. Websites dealing with E-commerce usually use this type of SSL certificates due to the amount of sensitive data related to banking details and payment.
Extended Validation SSL (EV)
EV certificates are again more expensive than the DV ones but come with additional validations of businesses and higher amount of money guarantee. Extended Validation SSLs aim at informing users that the organization has gone through careful examination for its identity and activity. A website using an EV SSL is displayed with green padlock and green address bar with the name of the business. These are suitable for medium and large businesses as well as for e-commerce websites.
Wildcard SSL is the most popular choice for organizations that manage several subdomains to the main one. For example, the subdomains blog.website.com and news.website.com could be protected with a single WildCard certificate for *.website.com. These certificates are extremely suitable for big corporate websites, e-commerce sites, bank websites and fincancial institutions.
Which is the right certificate for your website?
In order to make the right decision when choosing an SSL for your website you need to be aware of the main pecularities that different types have:
- Type of validation – whether you want to validate the domain name only
- Level of cryptation – SSL certificates have a standard length of 128-bit or 256-bit which determines the length of the cryptation key.
- Insurance coverage – the amount of money guarantee differs with the different types of SSL certificates and could reach up to $ 1,5 mln.
- Issue time – depending on the certificate chosen and its issuer the time for issuing may vary from 24 hours to 10 days.
- Mobile device compatibility – most SSL certificates are mobile friendly but you must check in advance to avoid the need of change on a later stage.
- Site seal - Depending on the type of certificate you can put static or dynamic seal on your website.
- Number of protected domains, subdomains, SAN Support – depending on the type of SSL certificate it can protect more than one subdomain (Wildcard SSL) or several other domains (Multi-domain SSL). SAN Support determines how many san-positions could be protected by this certificate. If a DV could protect www.site1.com and site1.com then multi-domain certificates could protect up to 3 different san-positions, e.g. www.site1.com, site1.com, www.site2.com.
- Price – SSL certificates validation domain names only are cheaper than the ones offering additional validations for a business and provide higher money guarantees.
Which are the most popular SSL certificates?
Geotrust Rapid SSL is a certificate that validate the domain of your website. Due to its affordable price, quick activation and the service offered it is one of the most popular SSLs on the market. After you request it you can have an active SSL for your site within 24 hours. The level of cryptation is 256 bit and the guarantee in case of a problem is $10,000. Moreover, the certificate is mobile friendly and offers Static seal. It is suitable for small businesses and startup e-commerce stores.
Comodo Essential SSL
This certificate validates your website’s domain. It is being issued within a day and the money guarantee is again $10,000 with 256-bit cryptation level. Commodo Essential is mobile friendly, as well. It is usually being used by business websites and small online stores.
Comodo Instant SSL PRO
This is an Organisation-validation SSL certificate. It is being issued for up to 72 hours. It also enables 256-bit cryptaion + mobile-device compatibility. The money guarantee provided by Comodo in case of data stealing is $100,000. This certificate provides dynamic seal for your site. It is suitable for developed online stores that want to verify their identity online.
Thawte web server
Thawte web server is an Organization Validation SSL certificate. Its cryptation level is 256 bit and it is being issued within 3 days. It offers dynamic site seal and is also mobile friendly. The money guarantee provided by the issuer is $1,250,000 in case of data breach. Last but not least, this certificate has San Support. This function enables the protection of one domain name more with the same SSL certificate.
Comodo Positive EV SSL
This is an Extended-validation certificate. It could be issued within 4-10 working days. The level of cryptation is 256 bits. $1,000,000 is the money guarantee provided by Comodo in case of data breach. The certificate offers dynamic site seal and is also mobile friendly. The green line in the address bar allows for easier indication of the active SSL to the user.
Thawte SSL EV
The validation of this type of SSL is Extended. It offers dynamic site seal and 256-bit cryptation. The issuing of the certificate takes between 4 and 10 days. It is compatible with mobile devices and enables additional SAN support for one domain. The guarantee provided is $1,500,000 and the certificate comes with a green bar indicating the high level of security in the address bar.
Let’s Encrypt is a free alternative for everyone who wants to validate the domain of their website. It does not validate the organization and does not ensure money guarantee in case of a problem with the data. However, installing Let’s Encrypt is a way to show your customers you care about the security of information going through your webpage. For all users of shared hosting in HostPulse we have provided the quick activation of Let’s Encrypt. With few clicks only they could activate the service via their cPanel.
About the GDPR
The new General Data Protection Regulation aims at changing the way personal data are being protected with more regulations. The GDPR makes it possible for users to manage their personal information on the Web. The main objective of the law is to protect personal data within the EU.
The activation of an SSL will not fully prepare you for the new regulation but is one of the steps you could take to protect the personal data of your users.
The SSL/TLS certificate is vital in case you want to guarantee security for your users while they browse and enter personal information on your website. By cryptating the connection between your website and users you increase their trust and confidence in your business which leads to more revenue and better user experience.
SSL legitimates your website and increases the SEO ranking in search engines pushing it forward in the search results. Last but not least, the SSL allows for the use of the latest protocol – HTTP/2. Using HTTP/2 in combination with SSL certificate you increase the speed at which the server responds to user requests and increase the protection level of your website.
On the other side, using SSL for your website you will respond to the latest technological tendencies to increase the security of the Web and to protect user data online. With the cryptation of the connection you will defend your website and prevent it from appearing as Not secure on Chrome.
See more about what is an SSL certificate and why you need cryptated connection to your website in our video: